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Mr.  Richard  Gregg 
Commissioner 

Financial  Management  Service 
Department  of  the  Treasury 

Subject:  Internal  Controls:  Disbursement  Processing  Controls  Need  Improvement 
Dear  Mr.  Gregg: 

We  recently  reported  on  the  U.S.  government’s  financial  statements  for  fiscal  year  | 

1999. 1  In  connection  with  fulfilling  our  requirement  to  audit  these  statements,  we  J 

tested  certain  internal  controls  over  federal  disbursements  processed  by  the  ] 

Department  of  the  Treasury’s  Financial  Management  Service  (FMS).2  With  some  f 

exceptions  (the  largest  being  the  Department  of  Defense) ,  FMS  makes  disbursements 
for  all  federal  agencies  through  its  Austin,  Chicago,  Kansas  City,  Philadelphia,  and 
San  Francisco  Regional  Financial  Centers  and  the  Birmingham  Debt  Management 
Operations  Center  (Centers)  ,3  For  fiscal  year  1999,  the  Centers  reported  processing 
over  875  million  disbursements  totaling  over  $1.2  trillion. 

The  Centers  generate  disbursements  via  check,  electronic  fund  transfer  (EFT) ,  or 
Fedwire.4  These  disbursements  for  fiscal  year  1999  were  over  280  million  checks 
amounting  to  over  $260  billion,  over  595  million  electronic  fund  transfers  amounting 
to  over  $710  billion,  and  over  50,000  Fedwires  amounting  to  over  $230  billion.  Centers 
also  process  Automated  Standard  Application  for  Payments  (ASAP)  system 


'Financial  Audit:  1999  Financial  Report  of  the  United  States  Government  (GAO/AIMD-OO-131, 

March  31,  2000) 

231U.S.C.  331(e)  (1994). 

beginning  October  1,  1999,  the  Birmingham  Financial  Center  became  the  Birmingham  Debt 
Management  Operations  Center  and  ceased  routine  disbursing  operations.  This  Center  currently  only 
makes  residual  payments  to  payees  under  the  Treasury  Offset  Program. 

’Fedwire  is  a  telecommunications  network  that  electronically  links  FMS  to  the  Federal  Reserve  Bank 
of  New  York  and  handles  low-volume,  high-dollar  value,  or  same-day  payment  requests. 
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enrollments.5  The  Centers  reported  that  federal  agencies  authorized  payments  of  over 
$239  billion  in  fiscal  year  1999  using  the  ASAP  system.  As  part  of  their  disbursement 
processing,  Centers  also  perform  claims  and  various  accounting  functions.  The 
claims  function  primarily  relates  to  the  crediting  back  of  funds  to  the  requesting 
agency  in  cases  where  disbursements  have  been  canceled  or  returned. 

The  purpose  of  this  letter  is  to  provide  the  results  of  our  work  and  our 
recommendations  for  improvement  related  to  controls  over  safeguarding  of  assets 
and  documenting  disbursements  and  reconciliation  of  reports  as  well  as  the  results  of 
our  follow-up  on  previously  suggested  improvements.6  Although  the  internal  control 
matters  are  not  material  in  relation  to  the  federal  government’s  fiscal  year  1999 
financial  statements,  they  warrant  your  attention. 

Results  in  Brief 

Our  testing  of  manual  controls  and  procedures  indicated  weaknesses  related  to  the 
safeguarding  of  vulnerable  negotiable  assets  at  the  Centers  that  increase  the  risk  of 
fraud  and  unauthorized  disbursements.  Specifically,  our  testing  disclosed  the 
following. 

•  FMS  Centers’  employment  screening  practices  are  inconsistent  among  the  Centers 
and  less  rigorous  than  those  at  another  federal  entity  where  employees  have 
access  to  negotiable  assets  and  related  records.  For  example,  some  Centers  do 
not  initiate  fingerprint  checks  of  newly  hired  staff  prior  to  the  start  of  their 
employment  or  prohibit  new  employees’  access  to  sensitive  job  positions  until  the 
results  of  their  fingerprint  checks  are  received  and  reviewed. 

•  Some  Centers  are  not  following  FMS’  procedures  for  control  over  checks  awaiting 
destruction  and  issued  checks  returned  for  cancellation.  For  example,  we  found 
that  two  Centers  had  unused  remnants  of  check  webs7  awaiting  destruction  that 
had  not  been  defaced,  and  three  Centers  did  not  adhere  to  requirements  for 
processing  negotiable  returned  checks  under  joint  control  until  the  checks  were 
defaced.  Additionally,  one  Center  was  not  performing  a  required  reconciliation  of 
its  returned  check  cancellations. 

•  FMS  did  not  have  its  revised  ASAP  system  enrollment  processing  procedures  in 
place  at  September  30, 1999,  and  the  three  Centers  that  process  ASAP  system 


sThe  ASAP  system,  jointly  implemented  by  FMS  and  the  Federal  Reserve  Bank  of  Richmond,  is  an 
electronic  payment  and  information  system.  Under  this  system,  once  enrolled,  an  organization  can 
draw  federal  funds  from  bank  accounts  preauthorized  by  federal  agencies.  We  will  separately  report 
the  results  of  our  contractor  testing  of  the  ASAP  and  other  FMS  systems’  electronic  data  processing 
controls. 

0 Internal  Controls:  Matters  Related  to  Disbursements  (GAO/A1MD-99-157R,  June  3,  1999). 

7  A  web  is  a  large,  continual  roll  of  blank  check  stock  that  is  fed  into  a  check  printer.  A  web  may 
contain  either  40,000  or  80,000  blank  checks. 
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enrollments  continued  to  have  inadequate  segregation  of  duties  related  to  the 
bank  confirmation  process.  Subsequently,  FMS  advised  us  that  as  of  October  1, 
1999,  it  had  implemented  its  revised  procedures. 

In  addition,  testing  indicated  internal  control  weaknesses  related  to  documenting  the 
verification  of  the  disbursement  authorization  process  and  the  reconciliation  of 
certain  reports  to  assure  that  the  disbursements  are  valid  and  FMS’  financial  records 
are  complete  and  accurate.  Specifically,  our  testing  disclosed  the  following. 

•  For  the  date  tested,  one  Center  did  not  document  the  supervisory  or  independent 
review  of  the  agency  certifying  officer’s  signature  to  verify  the  validity  of  the 
disbursement  requests. 

•  For  the  date  tested  at  another  Center,  an  unauthorized  person  signed  forms 
crediting  funds  for  a  returned  Fedwire  to  the  originating  agency. 

•  For  the  month  tested,  two  Centers  had  not  completely  reconciled  their  monthly 
outstanding  courtesy  disbursement  reports.8 

Our  fiscal  year  1999  testing  disclosed  that  FMS'  and  the  Centers’  corrective  actions 
resolved  previously  reported  weaknesses  relating  to  (1)  the  supervisory  review, 
approval,  and  documentation  of  the  disbursement  processing  progress  sheets  and 
(2)  enrollment  processing  and  supervisory  review  related  to  ASAP.  This  year’s 
recommended  improvements  include  matters  we  reported  on  last  year  for  which 
FMS’  corrective  actions  were  not  fully  implemented  as  of  the  end  of  the  fiscal  year. 
Specifically,  reconciliation  of  the  returned  check  cancellations,  inadequate 
segregation  of  duties  in  ASAP  enrollment  processing,  verification  of  the  agency 
certifying  officer’s  signature,  and  reconciliation  of  courtesy  disbursements.  FMS 
informed  us  that  it  had  completed  corrective  actions  to  address  the  ASAP  segregation 
of  duties  and  the  reconciliation  of  courtesy  disbursement  weaknesses  during  fiscal 
year  2000.  We  are  also  recommending  improvements  to  employment  screening 
practices,  controls  over  checks  awaiting  destruction  and  returned  checks,  and 
authorizations  for  crediting  returns  of  canceled  Fedwire  disbursements.  These 
recommendations  are  intended  to  strengthen  controls  over  safeguarding  of  assets 
and  documentation  for  disbursements  and  reconciliation  of  reports. 

In  his  comments  on  a  draft  of  this  letter,  the  FMS  Commissioner  stated  that  he 
concurred  with  our  findings  and  recommendations  and  that  FMS  has  actions 
currently  in  progress  or  planned  to  address  the  issues  raised  in  the  letter. 


‘Courtesy  disbursements  are  replacement  benefit  checks  issued  at  the  request  of  an  agency  when  the 
intended  recipient  notifies  the  agency  that  the  original  check  was  not  received.  Courtesy 
disbursements  are  charged  to  a  special  FMS  account  rather  than  to  the  agency.  As  part  of  the  courtesy 
disbursement  process,  the  original  check  is  canceled  and  a  special  account  is  credited  to  offset  the 
original  charge.  FMS  produces  a  monthly  report  of  outstanding  courtesy  disbursement  balances  for  the 
Centers  to  reconcile. 
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Scope  and  Methodology 

As  part  of  fulfilling  our  requirement  to  audit  the  U.S.  government’s  financial 
statements,  we  performed  tests  of  manual  controls  and  procedures  over  the 
delegation  and  designation  of  disbursing  authority  for  Certifying  Officers;  the 
processing  of  check,  EFT,  and  Fedwire  disbursements;  ASAP  system  enrollments; 
and  examination/o.bservation  of  selected  claims  and  accounting.  We  also  reviewed 
certain  hiring  practices.  For  fiscal  year  1997,  the  first  year  we  reported  on  the  U.S. 
government’s  financial  statements,  we  statistically  selected  samples  of  transactions 
and  tested  the  internal  controls  relating  to  delegation  and  designation  controls  for 
Certifying  Officers;  and  check,  EFT,  and  Fedwire  disbursements.  We  also  performed 
nonstatistical  internal  control  tests  for  ASAP  system  enrollments  and  for  claims 
activities  and  accounting  functions  that  were  not  susceptible  to  statistical  testing. 

The  internal  control  matters  we  found  were  not  material  in  relation  to  the  U.S. 
government’s  financial  statements.  As  a  result,  for  fiscal  years  1998  and  1999,  testing 
was  primarily  limited  to  follow-up  on  FMS  actions  to  address  the  matters  identified  in 
our  prior  reports  and  to  reconfirm  the  existence  and  functioning  of  the  manual 
controls  and  procedures  originally  tested. 

Thus,  for  fiscal  year  1999,  we  performed  tests  to  evaluate  the  corrective  actions,  if 
any,  on  suggestions  in  our  previous  report.  We  used  nonstatistical  tests  and  selected 
specific  disbursement  processing  steps  for  transactions  in  a  day  in,  or  the  month  of, 
September  1999,  a  date  that  allowed  FMS  time  to  institute  corrective  actions.  Given 
the  nonstatistical  manner  for  selecting  items,  the  results  of  this  work  are  not 
projectable.  However,  in  situations  where  FMS  has  yet  to  take  or  complete 
corrective  actions  on  previously  reported  weaknesses  and  our  testing  reconfirmed 
the  existence  of  these  weaknesses,  we  believe  such  weaknesses  require  management 
attention. 

To  reconfirm  the  existence  and  functioning  of  manual  controls  and  procedures  at  the 
five  Centers,  we  also  performed  nonstatistical  testing  of  transactions  on  the  days  that 
the  Centers  processed  large  volumes/dollars  of  disbursements.9  We  examined 
selected  documentation,  performed  physical  observations,  and  held  discussions  with 
FMS  and  Center  officials  and  staff  relating  to  (1)  the  delegation  and  designation  of 
Certifying  Officers,  (2)  check,  EFT,  and  Fedwire  disbursement  transactions  at  each 
Center,  (3)  ASAP  system  enrollments,  (4)  various  processes  related  to  claims  and 
accounting,  and  (5)  employment  screening  practices  being  used  at  the  Centers  from 
October  1,  1998  through  August  31,  1999.  The  results  of  this  testing  are  also  not 
projectable. 

We  reviewed  FMS’  Field  Operations  Manual  (FOM),  which  contains  a  framework  for 
the  operating  procedures  to  be  used  by  the  Centers.  We  also  considered  the 


“Because  of  changes  in  the  nature  of  operations  at  the  Birmingham  Center,  we  limited  our  work  to 
follow-up  testing,  where  appropriate,  for  that  Center.  In  addition,  only  the  Philadelphia  and  San 
Francisco  Centers  process  Fedwire  disbursements  and  only  the  Kansas  City,  Philadelphia,  and  San 
Francisco  Centers  process  ASAP  enrollments. 
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Comptroller  General’s  standards  for  internal  controls  in  the  federal  government.10 
This  document,  issued  pursuant  to  the  Federal  Managers’  Financial  Integrity  Act, 
states  that  internal  control  is  a  major  part  of  managing  an  organization  and  provides 
an  overall  framework  for  establishing  and  maintaining  such  controls.  The  Standards 
include  the  plans,  methods,  and  procedures  for  organizations  to  use  to  meet  missions, 
goals,  and  objectives.  Internal  control  also  serves  as  the  first  line  of  defense  in 
safeguarding  assets  and  preventing  and  detecting  errors  and  fraud.  We  performed  our 
audit  work  in  accordance  with  generally  accepted  government  auditing  standards 
from  June  1999  through  February  2000.  The  Commissioner  of  FMS  provided  written 
comments,  which  are  discussed  in  the  “Agency  Comments  ”  section  of  this  letter  and 
reprinted  in  Enclosure  I.  In  addition,  FMS  provided  certain  technical  comments, 
which  we  have  incorporated  in  the  letter  as  necessary. 

Controls  Over  Safeguarding  of  Assets  Need  Improvement 

We  found  internal  control  weaknesses  that  increase  the  risk  of  possible  fraud,  theft, 
and  misuse  of  vulnerable  negotiable  assets  and  could  result  in  unauthorized 
disbursements.  These  weaknesses  related  to  (1)  Center  employment  screening 
practices,  (2)  controls  over  checks  awaiting  destruction  and  returned  checks,  and 
(3)  segregation  of  duties  in  ASAP  system  enrollment  processing. 

The  Comptroller  General’s  Standards  state  that  appropriate  hiring  practices  are  a 
critical  factor  in  an  effective  control  environment.  The  Standards  also  require  an 
agency  to  establish  physical  control  to  secure  and  safeguard  vulnerable  assets. 
According  to  these  Standards,  access  to  resources  and  records  should  be  limited  to 
authorized  individuals  and  accountability  for  their  custody  and  use  should  be 
assigned  and  maintained.  Additionally,  the  Standards  note  that  key  duties  and 
responsibilities  need  to  be  divided  or  segregated  among  different  people  to  reduce 
the  risk  of  error  or  fraud. 

Employment  Screening  Practices 

For  Center  employees  occupying  job  positions  with  access  to  negotiable  assets  and 
related  records,  our  review  disclosed  that: 

•  three  of  the  five  Centers  do  not  initiate  fingerprint  check  investigations  for  new 
employees  prior  to  the  employees’  start  dates,  and  none  of  the  Centers  prohibit 
new  employees  from  being  assigned  to  positions  with  such  access  until  the  results 
of  fingerprint  checks  are  received  and  reviewed  and 

•  FMS  does  not  require  periodic  background  investigation  updates  on  all  employees 
with  such  access. 

Effective  hiring  practices,  which  can  mitigate  the  risk  associated  with  personnel 
occupying  job  positions  that  an  agency  considers  sensitive,  include  completion  of 


10 Standards  for  Internal  Control  in  the  Federal  Government  (GAO/AIMD-OO-21.3.1,  November  1999). 
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fingerprint  checks  on  prospective  employees  prior  to  their  start  dates  or  prohibiting 
their  access  to  sensitive  job  positions  until  the  results  of  fingerprint  checks  are 
received  and  reviewed.  We  were  informed  that  Center  employment  is  conditional 
until  successful  completion  of  a  comprehensive  background  investigation.  However, 
Centers  are  not  required  to,  and  some  do  not,  initiate  fingerprint  checks  prior  to 
employment,  prohibit  access  to  negotiable  assets  and  related  records  until  the 
fingerprint  check  results  are  received  and  reviewed,  and  conduct  periodic 
background  investigation  updates.  As  a  result,  the  potential  risk  of  employee  theft, 
fraud,  and  misuse  of  negotiable  assets  is  increased. 

While  not  required  by  FMS  policy,  fingerprint  checks  on  prospective  employees 
before  their  start  dates  becomes  important  considering  the  length  of  time  involved  in 
completing  a  comprehensive  background  investigation.  We  were  informed  that 
completion  of  a  comprehensive  background  investigation,  which  is  performed  by 
another  federal  agency,  routinely  takes  75  to  120  days  but  could  take  longer  in 
unusual  circumstances.  In  addition,  FMS  policy  does  not  prohibit  access  for  new 
employees  to  areas  with  negotiable  assets  and  related  records  pending  the  results  of 
their  fingerprint  checks  being  received  and  reviewed.  All  of  the  Centers  told  us  that 
FMS’  Security  Branch  performs  local  preemployment  investigations  on  prospective 
employees  that  can  include  (1)  local  police  and  court  checks,  (2)  inquiries  of  past 
employment  and  personal  references,  and  (3)  credit  checks.  However,  such 
investigations,  because  they  are  essentially  local  in  nature,  lack  the  scope  of  a 
national  fingerprint  check.  We  are  aware,  as  a  result  of  our  other  work,  that  the 
Internal  Revenue  Service  (IRS)  recently  issued  a  policy  stating  that  IRS  will  not 
employ  any  applicants  in  sensitive  areas  (where  cash  and  negotiable  checks  are 
handled)  before  receiving  the  results  of  fingerprint  checks."  These  procedures 
provide  IRS  with  the  ability  to  more  quickly  identify  potential  risks  with  employees 
rather  than  waiting  until  the  comprehensive  background  investigation  is  completed. 

We  were  told  that  FMS  does  perform  routine  update  investigations  on  its  employees 
designated  as  high  risk.12  However,  there  is  no  requirement  to,  and  FMS  does  not, 
perform  update  investigations  on  all  other  employees  occupying  sensitive  positions 
involving  access  to  negotiable  assets  and  related  records.  We  believe  periodic  update 
investigations  of  such  employees  would  constitute  good  business  practice.  Further, 
we  note  that  IRS  and  certain  other  agencies  require  periodic  update  investigations  for 
employees  based  on  the  agency’s  risk  assessment  of  the  sensitivity  of  the  position. 
The  periodic  updates  provide  agency  management  with  additional  information  with 
which  to  better  assess  the  risks  associated  with  potential  changes  to  employees’ 
financial  and/or  personal  circumstances. 


"Internal  Revenue  Service:  Physical  Security  Over  Taxpayer  Receipts  and  Data  Needs  Improvement 
(GAO/AIMD-99-15,  November  30,  1998). 

i2FMS  considers  high-risk  designation  to  include  positions  with  broad  scope  of  policy  or  program 
authority  that  have  the  potential  for  exceptionally  serious  impact  involving  duties  especially  critical  to 
the  agency  or  program  mission. 
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Controls  Over  Checks  Awaiting  Destruction  and  Returned  Checks 

During  the  course  of  our  work,  we  observed  a  number  of  negotiable  checks  awaiting 
destruction  that  had  not  been  defaced  because  some  Centers  did  not  adhere  to 
certain  FMS  policies.  Two  Centers  had  not  defaced  the  remaining  blank  checks  at  the 
end  of  check  webs  that  could  no  longer  be  used  in  the  production  process,  and  one 
Center  had  not  defaced  all  of  its  ruined  checks  as  required.13  Also,  contrary  to  FOM 
requirements  and  similar  to  what  we  reported  in  a  previous  letter,  we  observed 
instances  where  three  Centers  had  only  a  single  person  opening  and  defacing 
returned  checks.  At  two  of  those  Centers,  the  staff  processed  returned  checks  at 
desks  that  were  not  clear  of  extraneous  materials.  The  FOM  requires  that  checks 
ruined  or  unused  during  production  processing  and  issued  checks  returned  for 
cancellation  be  promptly  defaced.  In  addition,  the  FOM  requires  returned  checks  to 
be  processed  under  joint  custody  and  supervisory  control  in  a  secured  work  area 
clear  of  extraneous  material.  Failure  to  adhere  to  these  FOM  requirements  increases 
the  risk  that  these  checks  could  be  stolen  and  fraudulently  negotiated. 

Finally,  in  previous  years,  we  reported  that  several  Centers  had  not  completely 
reconciled  their  returned  check  cancellations  for  the  days  tested.  In  our  fiscal  year 
1999  testing,  one  Center  had  not  performed  this  reconciliation  for  the  day  tested. 
Reconciliation  of  the  number  of  returned  and  other  checks  available  for  cancellation14 
to  the  number  of  checks  canceled  is  essential  to  ensure  that  all  returned  checks  have 
been  canceled  or  properly  accounted  for.  The  importance  of  this  procedure  is 
heightened  by  the  continuing  existence  of  a  programming  error  in  the  computer¬ 
generated  automated  check  reconciliation  report.  Without  this  reconciliation,  FMS 
cannot  be  assured  that  all  returned  checks  have  been  fully  accounted  for. 

Segregation  of  Duties  -  ASAP 

Last  year,  we  reported  that  the  Centers  that  process  ASAP  enrollments  need  to 
improve  segregation  of  duty  controls  related  to  processing  ASAP  bank  confirmations. 
In  fiscal  year  1999,  FMS  informed  us  it  had  not  yet  finalized  revisions  to  the  ASAP 
enrollment  procedures.  As  a  result,  Center  staff  who  input  bank  data  into  the  system, 
including  user  bank  accounts  data,  could  prepare,  receive,  and  reconcile  the  bank 
confirmation  letters.  Segregation  of  duties  in  the  ASAP  bank  confirmation  process  is 
an  essential  internal  control  and,  without  it,  FMS  faces  increased  risk  that  error  or 
fraud  might  occur. 

During  fiscal  year  2000,  FMS  issued  its  revised  ASAP  enrollment  procedures  that  if 
properly  implemented,  should  resolve  this  issue.  We  will  evaluate  the  effectiveness  of 


,3Ruined  checks,  which  can  be  negotiable,  could  include  printed  checks  rejected  because  of  poor  print 
quality,  checks  mutilated  during  processing,  and  mistyped  manual  checks. 

''“Available”  checks  for  cancellation  include  checks  mailed  from  the  Center  but  returned  to  the  Center 
for  various  reasons,  e.g.,  undeliverable  by  the  U.S.  Postal  Service,  and  holds,  where  the  check  is  pulled 
for  cancellation  before  it  leaves  the  Center. 
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these  revised  procedures  as  part  of  our  audit  of  the  federal  government’s  fiscal  year 
2000  financial  statements. 

Internal  Controls  Over  Documentation  for  Disbursements 
And  Reconciliation  of  Reports  Need  to  Be  Strengthened 

We  found  internal  control  weaknesses  related  to  (1)  documenting  the  supervisory  or 
independent  review  of  the  agency  certifying  officer’s  signature  verification, 

(2)  personnel  authorizing  the  crediting  of  returned  canceled  Fedwire  disbursements, 
and  (3)  reconciling  courtesy  disbursements.  If  the  Centers  do  not  document  the 
performance  of  their  internal  control  processes  and  reconciliations,  FMS  lacks 
assurance  that  its  disbursements  are  appropriate  and/or  that  its  financial  records  are 
complete  and  accurate. 

The  Comptroller  General’s  Standards  require,  in  part,  the  following. 

•  Transactions  and  other  significant  events  should  be  authorized  and  executed  only 
by  persons  acting  within  the  scope  of  their  authority.  Authorizations  should  be 
clearly  communicated  to  both  managers  and  employees. 

•  Qualified  and  continual  supervision  should  be  provided  to  ensure  that  internal 
control  objectives  are  achieved.  In  addition,  transactions  should  be  promptly 
recorded  to  maintain  their  relevance  and  value  to  management  in  controlling 
operations  and  making  decisions. 

•  Internal  control  and  all  transactions  and  other  significant  events  need  to  be 
clearly  documented,  and  the  documentation  should  be  readily  available  for 
examination  and  should  appear  in  management  directives,  administrative  policies, 
or  operating  manuals. 

Documenting  the  Agency  Certifying  Officer’s  Signature  Verification 

As  in  our  previous  reports,  we  continue  to  find  a  lack  of  documentation  of  the 
supervisory  or  independent  review  of  the  signature  verification  process  on  the  paper 
SF  1166  Voucher  and  Schedule  of  Payments  (SF  1166).  This  year,  we  found  that  one 
of  the  Centers  did  not  document  the  supervisory  or  independent  verification  review 
for  all  three  paper  SF  1166s  processed  on  the  date  tested.15  Agency  Certifying 
Officers  use  either  an  electronic  or  paper  SF  1166  to  request  that  Centers  disburse 
funds  on  their  behalf.  FOM  Sections  1131  and  4114  require  that  the  Centers  verify  the 
Certifying  Officers’  signatures  before  processing  requested  disbursements.  Because 
the  verification  of  the  certifying  officer’s  signature  is  a  critical  element  in  ensuring  the 
validity  of  disbursements,  the  process  should  be  subject  to  qualified  and  continual 


i5FMS  receives  most  payment  requests  via  the  Treasury  Electronic  Certification  System.  In  place  of  a 
manual  signature,  this  system  uses  “smartcards”  and  personal  identification  numbers  to  authenticate 
payment  requests  based  on  the  encrypted  keys  assigned  to  each  Certifying  Officer  and  agency  Security 
Administrator. 
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supervision.  Without  the  appropriate  supervisory  or  independent  review,  FMS  lacks 
adequate  assurance  of  the  validity  of  the  paper  SF  1166  disbursement. 

Authorized  Signature  for  Return  of  Canceled  Fedwire  Disbursements 

We  found  that  one  Center  did  not  adhere  to  the  requirement  that  an  Accountable 
Officer,  or  an  authorized  designee,  sign  the  SF  Form  146,  Schedule  of  Canceled 
Fedwire  Item,  to  return  funds  from  a  canceled  Fedwire  disbursement  to  the 
originating  agency.  For  the  day  we  tested,  an  unauthorized  person  signed  all  three  SF 
Form  146s  processed  that  day.  Without  an  authorized  person  signing  the  form,  FMS 
lacks  assurance  that  Fedwire  cancellations  are  properly  processed  and  that  credit  is 
properly  returned  to  the  original  funding  agency. 

Reconciling  Courtesy  Disbursements 

As  reported  last  year,  Centers  did  not  have  consistent  and  uniform  policies  and 
procedures  for  the  complete  and  timely  reconciliation  of  courtesy  disbursements. 

This  year,  we  found  that  (1)  two  Centers  had  not  completely  reconciled  their 
outstanding  courtesy  disbursement  reports  for  the  month  tested  and  (2)  one  of  these 
Centers  had  not  received  an  outstanding  courtesy  disbursement  report  for  2  other 
months  during  the  fiscal  year.  Without  complete  and  timely  reconcilations  of 
courtesy  disbursements,  FMS  does  not  have  adequate  assurance  that  its  financial 
records  are  complete  and  accurate  and  that  the  special  courtesy  disbursement 
account  is  in  balance. 

An  official  at  one  of  the  two  Centers  that  had  not  reconciled  their  September  1999 
outstanding  courtesy  disbursement  reports  informed  us  that  the  Center  did  not  begin 
reconciliation  of  this  report  until  January  2000.  An  official  at  the  other  Center,  which 
had  partially  reconciled  its  September  report,  explained  that  the  Center’s  policy  is  to 
only  reconcile  outstanding  balances  over  30  days  old  because  timing  differences 
cause  many  of  the  outstanding  items  and  such  differences  automatically  clear  when 
another  FMS  entity  subsequently  posts  certain  data.  However,  this  official  stated  that 
the  Center  more  commonly  reconciles  outstanding  balances  once  they  are  over  60 
days  old.  While  timing  differences  can  be  expected,  such  delay  in  reconciliation 
postpones  the  Centers  from  being  assured  that  FMS’  financial  records  are  as 
complete  and  accurate  as  possible. 

In  addition,  one  of  the  two  Centers  above  did  not  receive  an  outstanding  courtesy 
disbursement  report  for  2  months  in  fiscal  year  1999.  This  report  would  enable  the 
reconciliation  to  be  performed.  Unless  the  Centers  receive  a  report  each  month,  even 
a  report  indicating  no  outstanding  balances,  they  will  not  know  if  reconciliations  are 
necessary.  As  a  result,  neither  the  Centers  nor  FMS  can  be  assured  that  the  special 
FMS  courtesy  disbursement  account  is  in  balance. 

During  fiscal  year  2000,  FMS  issued  guidelines  on  courtesy  disbursement 
reconciliations.  We  also  understand  that  these  courtesy  disbursement  procedures  and 
guidelines  may  be  further  modified  during  this  fiscal  year.  We  will  evaluate  the 
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guidelines  as  part  of  our  audit  of  the  federal  government’s  fiscal  year  2000  financial 
statements. 

Recommendations 

We  reaffirm  our  suggestion  from  our  prior  year’s  audit  that  FMS  needs  to  establish 
procedures  to  ensure  the  documentation  of  the  supervisory  or  independent  review  of 
paper  SF  1166  verification  processing  and  the  reconciliation  of  the  returned  check 
cancellations. 

To  address  the  disbursement  internal  control  weaknesses  we  identified  this  year,  we 
recommend  that  the  Commissioner  of  FMS  direct  the  Assistant  Commissioner  for 
Regional  Operations  to 

•  develop  and  implement  uniform  policies  and  procedures  requiring,  at  a  minimum, 
initiation  of  a  fingerprint  background  check  prior  to  the  start  date  of  new 
employees  and  prohibiting  new  employees  from  being  assigned  with  access  to 
negotiable  assets  and  related  records  until  the  results  of  fingerprint  checks  are 
received  and  reviewed; 

•  develop  and  implement  policies  and  procedures  for  periodic  background 
investigation  updates  for  employees  who  occupy  positions  with  access  to 
vulnerable  negotiable  assets  or  related  records; 

•  monitor  the  Centers’  adherence  to  FMS  policies  regarding  the  safeguarding  of 
ruined  and  returned  checks;  and 

•  monitor  the  consistent  implementation  of  required  procedures  to  ensure  that  only 
authorized  persons  sign  the  SF  146,  Schedule  of  Canceled  Fedwire  Item,  crediting 
funds  from  canceled  Fedwires  to  the  originating  agency. 

Because  of  the  recurring  nature  of  some  of  the  identified  weaknesses,  we  also 
reaffirm  our  suggestion  from  last  year  that  the  Commissioner  of  FMS  direct  the 
Assistant  Commissioner  for  Regional  Operations  to  ensure  that  applicable  guidance 
related  to  these  matters  be  incorporated  in  the  FOM  to  ensure  consistent  and  uniform 
operating  procedures  among  all  the  Centers. 

Agency  Comments 

In  commenting  on  a  draft  of  this  letter,  the  FMS  Commissioner  stated  he  concurred 
with  our  findings  and  recommendations  and  that  FMS  has  actions  currently  in 
progress  or  planned  to  address  the  issues  raised  in  the  letter. 


This  letter  contains  recommendations  to  you.  The  head  of  a  federal  agency  is 
required  by  31  U.S.C.  720  to  submit  a  written  statement  on  actions  taken  on  these 
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recommendations  to  the  Senate  Committee  on  Governmental  Affairs  and  the  House 
Committee  on  Government  Reform  within  60  days  of  the  date  of  the  report.  A  written 
statement  also  must  be  sent  to  the  House  and  Senate  Committees  on  Appropriations 
with  the  agency’s  first  request  for  appropriations  made  more  than  60  days  after  the 
date  of  the  letter. 

This  letter  is  intended  for  use  by  Treasury's  management  and  the  Inspector  General. 
We  are  sending  copies  of  this  letter  to  Senator  Fred  Thompson,  Chairman,  and 
Senator  Joseph  Lieberman,  Ranking  Minority  Member,  Senate  Committee  on 
Governmental  Affairs;  Representative  Dan  Burton,  Chairman,  and  Representative 
Henry  Waxman,  Ranking  Minority  Member,  House  Committee  on  Government 
Reform;  Mr.  Donald  Hammond,  Fiscal  Assistant  Secretary,  Department  of  the 
Treasury;  Mr.  Jeffrey  Rush,  Jr.,  Inspector  General,  Department  of  the  Treasury;  and 
the  Honorable  Jacob  J.  Lew,  Director,  Office  of  Management  and  Budget.  Copies  will 
also  be  made  available  to  others  upon  request. 

If  you  have  any  questions  regarding  this  report,  please  contact  me  at  (202)  512-3406. 
Key  contributors  to  this  assignment  are  listed  in  enclosure  II. 


Sincerely  yours, 


Gary  T.  Engel 
Associate  Director 
Governmentwide  Accounting  and 
Financial  Management  Issues 

Enclosures 
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Comments  From  the  Financial  Management  Service 


COMMISSIONER 


DEPARTMENT  OF  THE  TREASURY 
FINANCIAL  MANAGEMENT  SERVICE 
WASHINGTON,  D  C.  20227 

Jll  19  2000 


Mr.  Jeffrey  C.  Steinhoff 

Assistant  Comptroller  General  for  Accounting  and  Information 
Management  Issues 

United  States  General  Accounting  Office 
Washington,  DC  20548 

Dear  Mr.  Steinhoff: 


Thank  you  for  the  opportunity  to  review  your  draft  audit  report, 
Internal  Controls:  Disbursement  Processing  Controls  Need 
Improvement  -  July  kiOOO.  The  Financial  Management  Service  concurs 
with  the  recommendations  in  this  report.  Following  is  our 
response  and  a  general  statement  of  steps  we  will  take  to 
complete  needed  corrective  actions. 

GAO  Recommendation : 

Establish  procedures  to  ensure  the  documentation  of  the 
supervisory  or  independent  review  of  paper  SF  1166  verification 
processing  and  the  reconciliation  of  the  returned  check 
cancellations : 

FMS  Response:  Concur 

FMS  agrees  with  the  recommendation  to  ensure  documentation  of 
supervisory  or  independent  review  of  paper  SF  1166  verification 
at  all  Regional  Financial  Centers  (RFCs)  and  will  take  the 
necessary  corrective  actions. 

We  are  in  the  process  of  closing  the  Chicago  Financial  Center, 
which  is  where  GAO  noted  that  returned  checks  are  not  being 
properly  reconciled.  We  have  moved  all  returned  check  processing 
out  of  Chicago  to  other  RFCs.  Chicago  is  scheduled  to  close 
completely  on  November  1,  2000.  Although  no  similar  problems 
were  reported  at  the  other  RFCs,  we  will  issue  instructions  to 
reinforce  returned  check  reconciliation. 
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GAO  Recommendation: 

Develop  and  implement  uniform  policies  and  procedures  requiring, 
at  a  minimum,  initiation  of  a  fingerprint  background  check  prior 
to  the  start  date  of  new  employees  and  prohibiting  new  employees 
from  being  assigned  with  access  to  negotiable  assets  and  related 
records  until  the  results  of  fingerprint  checks  are  received  and 
reviewed . 

FMS  Response :  Concur 

FMS  will  research  and  investigate  the  best  course  of  action  to 
implement  the  fingerprint  background  checks  prior  to  the  start 
date  of  new  employees  being  assigned  access  to  negotiable  assets 
and  related  documents.  Initial  contact  has  been  made  with  the 
IRS,  OPM,  and  the  FBI  to  gather  information  on  equipment  needed, 
telecommunication  support,  processing  time  and  other  pertinent 
facts  pertaining  to  implementation  of  fingerprint  background 
checks.  We  anticipate  completion  of  our  research  efforts  and 
implementation  of  fingerprint  checks  in  approximately  six  months. 

Currently,  the  FMS  policy  and  practice  is  to  conduct  pre¬ 
employment  screening  investigations  of  applicants  for  FMS 
positions,  and  similar  pre-screening  investigations  of 
contractors,  prior  to  their  appointment  and  entry  into  FMS 
facilities  or  access  to  systems.  The  investigations  follow  the 
submission  of  completed  security  questionnaires  based  on  the 
position  and  their  designated  risk.  As  observed  by  the  GAO 
auditors,  the  investigation  includes  local  law  enforcement 
records  checks  (when  available),  inquiries  into  past  business  and 
personal  references,  and  credit  checks  (national  in  scope)  and  is 
routinely  completed  in  3-5  days.  The  investigation's  scope 
facilitates  controlling  and  identifying  potential  risks  to  FMS, 
and  may  be  broadened  to  include  scheduling  a  Special  Agreement' 
Check  (SAC)  by  OPM  if  potentially  disqualifying  issues  are 
raised. 


GAO  Recommendation: 

Develop  and  implement  policies  and  procedures  for  periodic 
background  investigation  updates  for  employees  who  occupy  job 
positions  with  access  to  vulnerable  negotiable  assets  or  related 
records . 
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FMS  Response:  Concur 

FMS  is  aware  of  this  issue  and  is  currently  conducting  an  FMS- 
wide  position  risk  designation  review  with  the  expected  outcome 
of  (1)  identifying  appropriate  position  risk  based  on  the  current 
FMS  mission  and  environment,  and  (2)  identifying  individuals  who 
require  investigations  or  reinvestigation  based  on  the  review. 

FMS  has  adopted  policy  that  complies  with  Federal  guidance 
concerning  reinvestigations  and  will  routinely  conduct 
reinvestigations  as  appropriate  for  the  position  risk. 
Implementation  of  this  policy  and  action  due  dates  will  commence 
upon  the  review's  completion,  which  is  expected  to  occur  during 
the  fourth  quarter  of  FY  2000. 

GAO  Recommendation : 


Monitor  the  Centers'  adherence  to  FMS  policies  regarding  the 
safeguarding  of  ruined  and  returned  checks . 

FMS  Response:  Concur 

FMS  will  take  the  necessary  steps  to  ensure  full  compliance  with 
the  procedures  for  defacing  blank  checks  at  the  end  of  the  check 
web,  defacing  spoiled  and  returned  checks,  and  observing 
separation  of  duties  and  reconciliation  requirements  for  returned 
checks . 


GAO  Recommendation: 

Monitor  the  consistent  implementation  of  required  procedures  to 
ensure  that  only  authorized  persons  sign  the  SF-146,  Schedule  of 
Canceled  Fedwire  Item,  crediting  funds  from  canceled  Fedwires  to 
the  originating  agency. 

FMS  Response:  Concur 

FMS  will  take  corrective  actions  to  assure  compliance. 

In  addition,  FMS  will  ensure  that  applicable  guidance  related  to 
the  above  recommendations  is  incorporated  in  the  Field  Operations 
Manual  (FOM),  as  necessary,  to  ensure  consistent  and  uniform 
operating  procedures  among  ail  Regional  Financial  Centers. 
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In  closing,  I  wish  to  emphasize  that  the  Financial  Management 
Serviced  Regional  Financial  Centers  have  comprehensive  internal 
controls  covering  the  disbursement  process  that  have  been 
developed  over  the  course  of  many  years  of  disbursement 
experience.  The  annual  GAO  audit  reviews  and  recommendations, 
together  with  our  cooperative  efforts,  will  help  ensure  continued 
strong  controls  over  the  disbursement  processes. 

Sincerely, 


Richard  L.  Gregg 


cc:  Donald  V.  Hammond 
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